To: 


Of: 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Pension House Exchange Limited 


72 Temple Chambers, Temple Avenue, London EC4Y OHP 


The Information Commissioner (“Commissioner”) has decided to issue 
Pension House Exchange Limited (“PHE”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is being issued because of a serious contravention of regulation 21B of 
the Privacy and Electronic Communications (EC Directive) Regulations 
2003. 


This notice explains the Commissioner’s decision. 


Legal framework 


PHE, whose registered office is given above (Companies House 
Registration Number: 10385681) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
in relation to occupational pension schemes or personal pension 


schemes contrary to regulation 21B of PECR. 


4. Regulation 21B paragraph (1) of PECR provides that: 


“(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual 


for the purpose of direct marketing in relation to occupational 


pension schemes or personal pension schemes, except where 


paragraph (2) or (3) applies.” 


5; Regulation 21B paragraphs (2), (3), and (4) provide that: 


“(2) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 
line. 


(3) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; 


the recipient of the call has an existing client relationship 
with the caller on the line and the relationship is such that 
the recipient might reasonably envisage receiving 
unsolicited calls for the purpose of direct marketing in 
relation to occupational pension schemes or personal 


pension schemes; and 


(c) the recipient of the call has been given a simple means of 


refusing (free of charge except for the costs of the 


transmission of the refusal) the use of the recipient’s 


contact details for the purpose of such direct marketing, at 


the time that the details were initially collected and, where 


the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 


(4) A subscriber must not permit the subscriber’s line to be used in 


contravention of paragraph (1)”. 


6. Regulation 21B paragraph 5 materially states that: 


“(5) In this regulation— 


(a) “authorised person” has the meaning given in section 31 of 


the Financial Services and Markets Act 2000; 


(b) “direct marketing in relation to occupational pension 


schemes or personal pension schemes” includes— 


(i) 


(ii) 


(iii) 


the marketing of a product or service to be 
acquired using funds held, or previously held, 
in an occupational pension scheme or a 


personal pension scheme, 


the offer of any advice or other service that 
promotes, or promotes the consideration of, 
the withdrawal or transfer of funds from an 
occupational pension scheme or a personal 


pension scheme, and 


the offer of any advice or other service to 


enable the assessment of the performance of 
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an occupational pension scheme or a personal 
pension scheme (including its performance in 


comparison with other forms of investment); 


(c) “existing client relationship” does not include a relationship 
established at the instigation of the caller primarily for the 


purpose of avoiding the restriction in paragraph (1); and 


(d) “occupational pension scheme” and “personal pension 
scheme” have the meanings given in section 1(1) of the 


Pension Schemes Act 1993.” 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Under section 55A (1) of the DPA (as amended by PECR 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) the Commissioner may serve a person with a monetary penalty 
notice if the Commissioner is satisfied that — 


Information Commissioner's Office 
“(a) there has been a serious contravention of the requirements of the 


Privacy and Electronic Communications (EC Directive) Regulations 


2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


11. The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


12. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 
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The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


PHE first came to the attention of the Commissioner having been 
contacted by a third party, which was regulated by the Financial 
Conduct Authority (“FCA”), alleging that PHE had been engaging in 
unsolicited calls to individuals for the purposes of direct marketing 
relating to pension schemes. In doing this, PHE had allegedly been 


passing itself off as the third party. 


The Commissioner subsequently consulted the FCA online register and 
contacted the FCA directly with regards to whether PHE was authorised 
to engage in such marketing calls. In doing so it was confirmed that 
neither PHE, nor its directors, were registered with the FCA, or 


authorised to make such calls. 


On 9 September 2019 the Commissioner contacted the 
Communications Service Provider (“CSP”) which was understood to be 
used by PHE, requesting call dialler records (“CDR”s) for all of the 
‘calling line identities’ (“CLI”s) allocated to PHE between the period of 9 
January 2019 to 8 September 2019. 


The subsequent response from the CSP indicated that a total of 


208,545 calls were made during this period from CLIs allocated to PHE. 


In the specific circumstances of this case, the Commissioner believed it 
appropriate to make an application to Court for a warrant to search 
PHE’s business premises in order to obtain information relevant to the 


alleged contravention. This warrant was granted and subsequently 
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executed on 3 October 2019. Asa result, the Commissioner seized 


paper documents and electronic devices for review and analysis. 


From the documents obtained, the Commissioner learned that amongst 
the methods used to collect data, PHE staff would seek to ‘connect’ 
with individuals on LinkedIn, and harvest the contact details provided 
on their personal accounts, in order to target them with direct 
marketing calls relating to pension schemes. A call script seized during 
the warrant makes specific reference to this as the method of obtaining 
an individual’s data and confirms that PHE offer a service of tracking 


down frozen pensions, and providing an “up to date transfer valuation”. 


In addition, it is apparent that PHE purchased data from third party 
data providers although it was not clear whether this data was being 


used by PHE for its calls relating to pension schemes. 


The Commissioner wrote to PHE on 25 October 2019 setting out her 
concerns with the organisation’s compliance with PECR and asking for 


further information to assist with the Commissioner’s investigation. 


In its response of 27 November 2019, a director of PHE confirmed that 
data obtained via LinkedIn was PHE’s only source of data, and that 
between 9 January 2019 and 3 October 2019 there were a total of 
289,679 calls made, of which 39,722 were connected. 


PHE provided no evidence that specific consent was sought from 
individuals on LinkedIn whose data was obtained. Furthermore, it was 
confirmed that neither PHE, nor a second organisation of which the 
director was in charge, was authorised by the FCA to conduct pension 


calls. 


The Commissioner made further enquiries with PHE on 9 December 


2019 and advised of her concerns with the way in which PHE had 
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obtained data via LinkedIn. Although PHE had previously confirmed 
that LinkedIn was the only source of data used, the Commissioner 
remained concerned by her findings from the warrant, not least 
regarding the possibility of data being obtained via third party sources, 
and asked for clarity on whether any such data was still being 
processed and for what purpose. PHE’s response indicated that no 
such data was still being processed. PHE’s response also confirmed 
that no training records are kept in relation to PECR training, nor are 
employees required to sign any documents to confirm that any such 


training has been undertaken. 


The Commissioner notes that during the period of contravention she 
received a total of three complaints regarding calls from a CLI 
attributed to PHE. In addition, the Commissioner was notified by the 
FCA of a further complaint on 23 September 2019, about a call which 
had taken place on 16 September 2019, during the period of 


contravention. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute a 
contravention of regulation 21B PECR by PHE and, if so, whether the 
conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that PHE has contravened regulation 21B of 
PECR. 


The Commissioner finds that the contravention was as follows: 
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Between 9 January 2019 and 3 October 2019 PHE made a total of 
39,722 connected unsolicited calls for the purposes of direct marketing 
in relation to occupational pension schemes or personal pension 
schemes contrary to regulation 21B of PECR. This resulted in a total of 


three complaints being made to the Commissioner. 


The Privacy and Electronic Communications (Amendment) (No. 2) 
Regulations 2018, which came into force on 9 January 2019, amended 
PECR to insert Regulation 21B which restricts calls made for the 
purposes of direct marketing in relation to occupational pension 


schemes or personal pension schemes. 


PHE would contact individuals, whose data had been scraped from 
LinkedIn contact lists, to discuss pension schemes with a view to 
arranging an introduction with an Independent Financial Advisor 
(“IFA”). Call scripts obtained from PHE’s own premises during the 
execution of a warrant demonstrate that PHE would make calls to 


subscribers to offer “up to date transfer valuations”. 


The calls made by PHE clearly constitute ‘direct marketing in relation to 
occupational pension schemes or personal pension schemes’ within the 
definition of regulation 21B(5)(b)[ii] PECR. Specifically, regulation 
21B(5)(b)[ii] PECR includes “the offer of any advice or other service 
that promotes, or promotes the consideration of, the withdrawal or 
transfer of funds from an occupational pension scheme or a personal 


pension scheme[...]”. 


The Commissioner finds in the alternative that the calls could be said to 
constitute direct marketing in accordance with the definition provided 
at regulation 21B(5)(b)[iii] PECR. Specifically, regulation 21B(5)(b)[iii] 


includes “the offer of any advice or other service to enable the 
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assessment of the performance of an occupational pension scheme or a 


personal pension scheme (including its performance in comparison with 


other forms of investment)”. 


To engage in such calls it is a requirement of regulation 21B PECR that 
the caller be an ‘authorised person or a person who is the trustee or 
manager of an occupational pension scheme or a personal pension 


scheme’. 


Regulation 21B(5)(a) PECR states that “authorised person” has the 
meaning given in Section 31 of the Financial Services and Markets Act 
2000 (“FSMA”). Section 31(1) FSMA lists the categories of persons 


who would constitute “authorised persons”. 


PHE has provided no evidence that it would qualify as an “authorised 
person”. In addition, the Commissioner is concerned by the tactics 
which PHE may have employed during its calls, i.e. there is evidence of 
multiple names and false authorisation numbers being quoted which 


would give individuals a misleading impression of the company. 


Furthermore, PHE’s listed ‘Nature of business’ on Companies House 
simply refers to it as being involved with “Market research and public 
opinion polling”, and the Commissioner has seen no evidence that PHE 
is itself a trustee or manager of an occupational pension scheme or a 


personal pension scheme. 


The Commissioner is therefore satisfied that PHE is not an authorised 


person for the purposes of regulation 21B PECR. 


The Commissioner is also satisfied that PHE is not a trustee or manager 
of an occupational pension scheme or a personal pension scheme for 


the purposes of regulation 21B PECR. 
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Therefore, neither paragraphs 2 or 3 of regulation 21B apply, and PHE 


cannot lawfully make direct marketing calls in relation to occupational 


pension schemes or personal pension schemes. 


Even if PHE were an an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a personal 
pension scheme, the Commissioner is satisfied that PHE had neither 
the consent of those who it called, nor an existing customer 


relationship with them, as required by regulation 21B(2)(b) or (3)(b). 


The Commissioner understands that PHE would obtain the details of 
individuals whom they intended to engage in direct marketing by 
having its staff add them as ‘connections’ on LinkedIn. Once 
connected, PHE would use the contact details provided on the 
individuals’ personal account pages for the purposes of its marketing 
campaign. It was explained during the course of the investigation that 
PHE interpreted an individual’s acceptance of a ‘connection’ request as 
confirmation that they would also consent to receiving direct marketing 
calls. This method of data scraping is wholly inadequate as a means of 


obtaining valid consent. 


The Commissioner is satisfied that between 9 January 2019 and 3 
October 2019 there were a total of 39,722 connected unsolicited calls 
for the purposes of direct marketing in relation to occupational pension 
schemes or personal pension schemes contrary to regulation 21B of 
PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
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Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 9 January 2019 and 3 
October 2019 there were 39,722 connected unsolicited direct 
marketing calls made to subscribers in relation to occupational pension 
schemes or personal pension schemes by an organisation not lawfully 
authorised to carry out such activities, and without valid consent. 
From this the Commissioner has recorded a total of three complaints. 
This represents a significant intrusion into the privacy of the recipients 
of such calls. Furthermore, the Commissioner notes that a total of 
289,679 calls were in fact made over the relevant period, which 
suggests that the extent of the contravention could potentially have 


been far higher. 


The Commissioner notes that PHE were not registered at all with the 
FCA during the period of the contravention. Furthermore, it is 
understood that PHE had been previously contacted by West Sussex 
Trading Standards in April 2018 when its attention was drawn to the 
intended legislative change regarding pension calls, and to the need to 
consider PECR when making direct marketing calls. Although this 
contact pre-dated the current contravention, and indeed the 
implementation of regulation 21B PECR, it is pertinent that PHE had 
previously had its attention directly drawn to the requirement to 


consider PECR when engaging in direct marketing calls. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 
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The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that PHE deliberately set out to 


contravene PECR in this instance. 


The Commissioner considers that PHE employed deliberate and opaque 
tactics to obtain the data of individuals to whom they could engage in 
direct marketing regarding pension schemes, following the 
implementation of legislation specifically aimed at protecting individuals 


from these practices. 


Further, and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, the Commissioner has considered whether PHE knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least because the issue of unsolicited calls in relation to 
occupational pension schemes or personal pension schemes has been 
widely publicised by the media as being a problem, so much so that it 
prompted recent legislative change to prohibit the making of such calls 
unless certain conditions are met. It is reasonable to suppose that any 
organisation wishing to carry out such activities should, and indeed 
must, be aware of its responsibilities in this area. Furthermore, the 
proposed legislative change was expressly brought to PHE’s attention 


by West Sussex Trading Standards prior to its implementation. 


The Commissioner has published detailed guidance on her website for 
those carrying out direct marketing calls for the purposes of pension 
schemes, explaining the strict criteria under which such calls can be 
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made. This guidance explains such calls must not be made in relation 
to pension schemes unless the person calling is a trustee or manager 
of a pension scheme or a is firm authorised by the Financial Conduct 


Authority, and the individual being called has specifically consented to 


such calls or has a defined existing client relationship. 


Secondly, the Commissioner has gone on to consider whether PHE 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


Reasonable steps in these circumstances may have included ensuring 
that it was, for the purposes of the legislation, an “authorised person”. 
The Commissioner is of the view that if PHE had familiarised itself with 
the relevant legislation and clear Government and ICO guidance it 
would have realised that any exemption which it purported to rely on 
for the conducting of its business would not meet the required 
threshold of being “authorised” for the purposes of regulation 21B 
PECR, and accordingly it should have known that it could not lawfully 
make unsolicited direct marketing calls for the purposes of pension 
schemes. Additionally, there is no evidence that PHE sought to take 
independent legal advice, or to request advice from the Commissioner, 
prior to engaging in its direct marketing campaign in relation to 
pensions. When asked for its understanding of its obligations under 
PECR, PHE responded with reference to being unable to contact 
individuals on the Telephone Preference Service (“TPS”) register. 
Registration for the TPS is irrelevant for the purposes of regulation 
21B; this statement further suggests that PHE was unaware of its true 
obligations when looking to conduct direct marketing calls relating to 


pensions. 
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Furthermore, PHE have failed to provide any evidence of consent for 

the direct marketing calls made, indeed it appears reasonable to 

suggest that PHE engaged in its direct marketing campaign without 

giving any consideration at all to obtaining the valid consent of those 

individuals it sought to contact. It harvested data from LinkedIn with 

the aim of contacting those individuals for the purposes of pension 

schemes and, when asked, PHE was unable to evidence any consent, 


stating just that it had deleted the LinkedIn connections after contact. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has also taken into account the following 


aggravating features of this case: 


Pension calls, in particular, can lead to high levels of financial detriment 
and/or emotional stress. It is for this reason that the restriction on such 


calls was introduced; 


The making of these calls would appear to be for financial gain as the 


organisation will profit from any business resulting from the calls; 


PHE’s responses to the Commissioner were not without delay; 


The Commissioner has concerns from her investigation that there may 


be an attempt by PHE to “phoenix” its operation under a new guise. 


60. 


61. 


62. 


63. 


64. 


65. 


66. 


@ 
ICO. 
Information Commissioner's Office 
The Commissioner is aware that PHE has recently been placed into 


creditors’ voluntary liquidation. This type of insolvency does not 


prevent regulatory action being taken by the Commissioner. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by PHE on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on PHE and notes its ‘liquidation’ status. However, in the 
particular circumstances of this case the Commissioner considers that a 


monetary penalty remains an appropriate and proportionate response. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls, particularly in relation to pension 
schemes, is a matter of significant public and parliamentary concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 


non-compliance, on the part of all persons running businesses currently 
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engaging in these practices. This is an opportunity to reinforce the 
need for businesses to ensure that they meet the strict criteria to 


engage in such activities and are only telephoning consumers who want 


to receive these calls. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £45,000 (forty-five thousand pounds) 
is reasonable and proportionate given the particular facts of the case 


and the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 14 January 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
13 January 2021 the Commissioner will reduce the monetary penalty 
by 20% to £36,000 (thirty-six thousand pounds). However, you 

should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 


and/or; 
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(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 7t day of December 2020. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1: Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


ce You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 
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LE1 8DJ 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state: - 


a) 


b) 


C) 


d) 


e) 


f) 


g) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the notice 


of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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